rpm package
opensuse/chromium&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/chromium&distro=openSUSE%20Tumbleweed
Vulnerabilities (4,970)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2015-1264 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature. | ||
| CVE-2015-1263 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted f | ||
| CVE-2015-1262 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text. | ||
| CVE-2015-1261 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or del | ||
| CVE-2015-1260 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code | ||
| CVE-2015-1259 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. | ||
| CVE-2015-1258 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via | ||
| CVE-2015-1257 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (containe | ||
| CVE-2015-1256 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree f | ||
| CVE-2015-1255 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by levera | ||
| CVE-2015-1254 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing. | ||
| CVE-2015-1253 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and exe | ||
| CVE-2015-1252 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large | ||
| CVE-2015-1251 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 20, 2015 | Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document. | ||
| CVE-2015-1250 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 1, 2015 | Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. | ||
| CVE-2015-1243 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | May 1, 2015 | Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other im | ||
| CVE-2015-1249 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | Apr 19, 2015 | Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. | ||
| CVE-2015-1248 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | Apr 19, 2015 | The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL. | ||
| CVE-2015-1247 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | Apr 19, 2015 | The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive in | ||
| CVE-2015-1246 | — | < 55.0.2883.75-3.1 | 55.0.2883.75-3.1 | Apr 19, 2015 | Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. |
- CVE-2015-1264May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature.
- CVE-2015-1263May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted f
- CVE-2015-1262May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.
- CVE-2015-1261May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or del
- CVE-2015-1260May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code
- CVE-2015-1259May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
- CVE-2015-1258May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via
- CVE-2015-1257May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (containe
- CVE-2015-1256May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree f
- CVE-2015-1255May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by levera
- CVE-2015-1254May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.
- CVE-2015-1253May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and exe
- CVE-2015-1252May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large
- CVE-2015-1251May 20, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document.
- CVE-2015-1250May 1, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2015-1243May 1, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other im
- CVE-2015-1249Apr 19, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
- CVE-2015-1248Apr 19, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL.
- CVE-2015-1247Apr 19, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive in
- CVE-2015-1246Apr 19, 2015affected < 55.0.2883.75-3.1fixed 55.0.2883.75-3.1
Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Page 227 of 249